RHSA-2026:21769HighCVSS 9.1

Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update

Published
May 28, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (35)

CVE-2026-33487 →CVE-2026-43869 →CVE-2026-33215 →CVE-2026-32280 →CVE-2026-32285 →CVE-2026-40890 →CVE-2026-41603 →CVE-2026-41605 →CVE-2026-32281 →CVE-2026-32286 →CVE-2026-33218 →CVE-2026-41602 →CVE-2026-41636 →CVE-2026-21728 →CVE-2026-27889 →CVE-2026-33813 →CVE-2026-29785 →CVE-2026-33216 →CVE-2026-34040 →CVE-2026-34986 →CVE-2026-25679 →CVE-2026-41604 →CVE-2026-32283 →CVE-2026-33186 →CVE-2026-33247 →CVE-2026-33413 →CVE-2026-33810 →CVE-2026-33997 →CVE-2026-41606 →CVE-2026-41607 →CVE-2026-4427 · pendingCVE-2026-27137 →CVE-2026-32282 →CVE-2026-33217 →CVE-2026-33219 →

📋 Description

CVE-2026-4427 — github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message CVE-2026-21728 — grafana/tempo: Tempo: Denial of Service via large queries CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27889 — github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame CVE-2026-29785 — github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-32285 — github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33215 — nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance CVE-2026-33216 — nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints CVE-2026-33217 — nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace CVE-2026-33218 — nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port CVE-2026-33219 — github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets CVE-2026-33247 — github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments CVE-2026-33413 — etcd: etcd: Authorization bypass allows information disclosure and denial of service CVE-2026-33487 — github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33813 — golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing CVE-2026-33997 — moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation CVE-2026-34040 — Moby: Moby: Authorization bypass vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40890 — github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input CVE-2026-41602 — github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation CVE-2026-41603 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation CVE-2026-41604 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41605 — Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability CVE-2026-41606 — Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion CVE-2026-41607 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41636 — apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion CVE-2026-43869 — Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation

🎯 Affected products22

  • Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:62b308e48b973c04509efc66de4cdf11acc729625b75f86bab27de82a7230d14_ppc64le as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:dc3c1cc6bdfbf29bf0182bacddcdde3de8517d294ca4f1516eda60f760ffe399_amd64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:df44aad9c2e9fec1d734e494c069cb89fd7b8f33050cfe9db3bdaef4c4ad7cc3_arm64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:fb7cd20d1a90d19fcaddfffd01a94e39dbcc9c97fc9a70e5d7eaefc570fd2dd7_s390x as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8c03495da4214e70589e238a60815c265223952470da6d80034e2f83de5c3c8e_ppc64le as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d91359dca7bc04e59f4f1c0d2e5c8a2ecfd92d3499636be065ec89e8ad2eac4f_amd64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e26dfe26504fa24a04d4e0372461414f6f73c601b7f2f4e7f5e2e520d3281ce8_arm64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:fc03a86fe38f6d3654c013dd47b330fbd0169f239fb21fd3c456ab78b6df3166_s390x as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:19014267212e075c68e50fecbe44eabaaadadae448b28b5cfbe3275f27f9fc93_s390x as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:42ab1234414fcdc369097e9c63bda3b4ea64c1e3eb87800a394898c91a2c43ad_ppc64le as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:b70fae10e34ad67aa1f347d2e1085a92e1a28666faa273fe3c0c01a4d0780777_amd64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bb02a2e251f898e1d34b6846001d13cc1e5454b071358556a77997f02f71401d_arm64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8959841bd45bb6a15ae4a88d37234b3ba36855be6d92e358fa363c6132ab6359_amd64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:33a5f0de8fa49bd67233f9dc5f4f5858858961ecb3da4bcc5c146ce5be91bcd6_ppc64le as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:6b9b507650bf0997ed9828b3d0b69777805aa33dd5b2988a2ef5b3b2bee00dbc_amd64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:74635c357ec4a8697076f015ac15853ee0259e0231620fa349d687be261beae4_arm64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eaae81482b89e7331d356ddadf8f698e5cfffc9ce4fb616f240f30c9f044ba59_s390x as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:176cfe7106e81ff28564ec2cf9e4041d0fcadc7b5ae7537a9cc6db63a8914e5c_s390x as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:48717ee862e1386928c2a20a3ed04464ad1fc3d519ef026a6fd615c13e22d51b_amd64 as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c985ba79e21f5c623fa1b350963d6a8915043e06184cde6f2d813a5c349a4886_ppc64le as a component of Red Hat multicluster global hub 1.5.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cffac2b05af519fbd27143d59321675ba8cfd2e4c1531fc15021bd8500987c62_arm64 as a component of Red Hat multicluster global hub 1.5.2

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Restrict network access to etcd server ports to ensure only trusted components can establish connections. Implement strong client identity at the transport layer, such as mTLS, with tightly scoped client certificate distribution. This will limit unauthorized access to etcd functions.

🔗 References (38)